容器安全最佳实践与工具链

dockerfile_security_checklist:
  base_image:
    - "使用特定版本tag，不用latest"
    - "选择最小基础镜像（alpine/slim/distroless）"
    - "使用可信的官方镜像"

  build_process:
    - "多阶段构建，减小最终镜像体积"
    - "不在镜像中包含密钥、证书、SSH私钥"
    - "使用.dockerignore排除不必要文件"
    - "合并RUN命令减少层数"
    - "清理包管理器缓存"

  runtime:
    - "使用非root用户运行"
    - "只暴露必要端口"
    - "设置只读文件系统（如可行）"
    - "使用HEALTHCHECK"

# GitHub Actions集成Trivy
name: Security Scan
on: [push, pull_request]

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

# Falco自定义规则
- rule: Detect Shell in Container
  desc: 检测容器中启动Shell
  condition: >
    spawned_process and
    container and
    proc.name in (bash, sh, zsh, ash) and
    not proc.pname in (cron, supervisord)
  output: >
    Shell started in container
    (user=%user.name container=%container.name
     shell=%proc.name parent=%proc.pname
     image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, runtime]

- rule: Write Below /etc
  desc: 检测对/etc目录的写入
  condition: >
    write_etc_common and
    container and
    not user_known_write_etc_conditions
  output: >
    File written below /etc in container
    (user=%user.name file=%fd.name
     container=%container.name image=%container.image.repository)
  priority: ERROR
  tags: [container, filesystem]

- rule: Outbound Connection to Suspicious IP
  desc: 检测连接到可疑IP
  condition: >
    outbound and
    container and
    fd.sip.name in (miners_ip_list)
  output: >
    Suspicious outbound connection
    (container=%container.name ip=%fd.sip command=%proc.cmdline)
  priority: CRITICAL
  tags: [container, network]

# 命名空间级别的安全标准
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # 三种安全级别: privileged, baseline, restricted
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

# 符合 restricted 安全标准的Pod
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  # 不使用hostNetwork
  hostNetwork: false
  # 不使用hostPID
  hostPID: false

  securityContext:
    # 以非root用户运行
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    # 使用Seccomp
    seccompProfile:
      type: RuntimeDefault

  containers:
    - name: app
      image: myapp:1.0.0@sha256:abc123...  # 使用digest
      securityContext:
        # 不允许提权
        allowPrivilegeEscalation: false
        # 不使用特权模式
        privileged: false
        # 只读根文件系统
        readOnlyRootFilesystem: true
        # 删除所有Linux capabilities
        capabilities:
          drop: ["ALL"]
      resources:
        limits:
          cpu: "500m"
          memory: "256Mi"
        requests:
          cpu: "100m"
          memory: "128Mi"
      # 需要可写目录时使用emptyDir
      volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: cache
          mountPath: /app/cache

  volumes:
    - name: tmp
      emptyDir:
        sizeLimit: "100Mi"
    - name: cache
      emptyDir:
        sizeLimit: "200Mi"

  # 使用专用ServiceAccount
  serviceAccountName: app-sa
  automountServiceAccountToken: false  # 不需要K8s API访问时禁用

# 默认拒绝所有流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

---
# 允许特定流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-to-api
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: web-frontend
        - namespaceSelector:
            matchLabels:
              name: monitoring
      ports:
        - protocol: TCP
          port: 8080

# 不要这样做 - Secret明文存在etcd中
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=      # base64, 不是加密
  password: cGFzc3dvcmQ=

# 推荐: 使用External Secrets Operator
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: db-credentials
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: production/database
        property: username
    - secretKey: password
      remoteRef:
        key: production/database
        property: password

# Sealed Secrets - 可以安全地提交到Git
# 使用kubeseal加密
# kubeseal --format=yaml < secret.yaml > sealed-secret.yaml

apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-credentials
  namespace: production
spec:
  encryptedData:
    username: AgBy3i4OJSWK+...  # 只有集群中的controller能解密
    password: AgCtr8p2E1xyL+...

# Kyverno策略 - 只允许签名的镜像
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "myregistry.io/*"
          attestors:
            - count: 1
              entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
                      -----END PUBLIC KEY-----